Validation bypass is possible in Json Pattern Validator

Description

In jpv (aka Json Pattern Validator) before 2.1.1, compareCommon() can be bypassed because certain internal attributes can be overwritten via a conflicting name, as demonstrated by ‘constructor’: {‘name’:’Array’}. This affects validate(). Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

Recommendation

Update the jpv package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.1.1
• Patched version(s): 2.1.1

References

• GHSA-rh46-3fgc-mvrf
• www.npmjs.com
• CVE-2019-19507
• CWE-287
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A7

Related Issues

• validator.js has a URL validation bypass vulnerability in its isURL function - CVE-2025-56200
• Validation bypass in jpv - CVE-2020-17479
• Validation Bypass in slp-validate - CVE-2019-16761
• Validation Bypass in kind-of - CVE-2019-20149

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

jpv